emotet | 716f89d824ea3daf14816f0b92013076c7709c5780d2d8550afe16d286f0fabb

Analysis

Target
emotet_exe_e4_716f89d824ea3daf14816f0b92013076c7709c5780d2d8550afe16d286f0fabb_2022-01-18__132659.exe.dll
Size 469KB
Sample220118-qqnqlsbdhp
SHA256 716f89d824ea3daf14816f0b92013076c7709c5780d2d8550afe16d286f0fabb
MD5 6cea6c0207e50ca0c7e261a8c2768a31
SHA1 f1b5d6b5043bc1faecc048f481b4233e6f0f0484
SHA512 690f46e82e087f17a73a3eca08a49684fda42a4e79a875412776d3084fefbbe7ef8f0d407314240dd6504f859f8e5458ce91ab763bd4a653caab6ef860ef4164
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3380	1600	regsvr32.exe	52
PID 1600 wrote to memory of 3380	1600	regsvr32.exe	52
PID 1600 wrote to memory of 3380	1600	regsvr32.exe	52
PID 3380 wrote to memory of 2988	3380	regsvr32.exe	53
PID 3380 wrote to memory of 2988	3380	regsvr32.exe	53
PID 3380 wrote to memory of 2988	3380	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_716f89d824ea3daf14816f0b92013076c7709c5780d2d8550afe16d286f0fabb_2022-01-18__132659.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_716f89d824ea3daf14816f0b92013076c7709c5780d2d8550afe16d286f0fabb_2022-01-18__132659.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_716f89d824ea3daf14816f0b92013076c7709c5780d2d8550afe16d286f0fabb_2022-01-18__132659.exe.dll",DllRegisterServer
    3⤵
    PID:2988

memory/3380-130-0x0000000004EC0000-0x0000000004EE6000-memory.dmp

Download